Skip to content

runc 1.0 -- "A wizard is never late, nor is he early, he arrives precisely when he means to."
Compare
Choose a tag to compare
@cyphar cyphar released this 22 Jun 06:09
v1.0.0
This tag was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.
84113ee
This commit was signed with the committer’s verified signature. The key has been revoked.
cyphar Aleksa Sarai
GPG key ID: 9D94B96321B9D012
Revoked
Learn about vigilant mode.

This release has quite a few last-minute bug-fixes and various correctness and
performance improvements (almost all of which are related to cgroup handling),
and is the first non-rc release of runc in 5 years (v1.0.0-rc1 was released in
2016). It's been a very long road, and we thank the many contributors and
maintainers that helped us get to this point (approximately 422 people in
total).

As runc follows Semantic Versioning, we will endeavor to not make any
breaking changes without bumping the major version number of runc.

However, it should be noted that Go API usage of runc's internal
implementation (libcontainer) is not covered by this policy -- for
historical reasons, this code was not moved into an "internal" package
(this feature did not exist in Go at the time) and because certain
projects currently depend on this, we have not yet moved this code into
an internal package. Despite this, we reserve the right to make breaking
changes in our Go APIs (though we will note such changes in our
changelog, and will try to avoid needless disruption if possible).

Breaking changes:

  • Removed libcontainer/configs.Device* identifiers (deprecated since rc94,
    use libcontainer/devices) (#2999)
  • Removed libcontainer/system.RunningInUserNS function (deprecated since
    rc94, use libcontainer/userns) (#2999)

Deprecations:

  • The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations). (#2917, #3004)

Bugfixes:

  • cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers). (#2951)
  • cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way. (#2965, #2967, #2968, #2964)
  • cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  • cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen. (#2955)
  • cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  • cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94) (#2997, #2996)

Improvements:

  • cgroupv2: support SkipDevices with systemd driver (#2958, #3019)
  • cgroup/systemd: return, not ignore, stop unit error from Destroy (#2946)
  • Fix all golangci-lint failures. (#2781, #2962)
  • Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts. (#2962)
  • cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update). (#2994)
  • cgroup1: blkio: support BFQ weights. (#3010)
  • cgroupv2: set per-device io weights if BFQ IO scheduler is available.
    (#3022)

Static Linking Notices

The runc binary distributed with this release are statically linked with
the following GNU LGPL-2.1 licensed libraries, with runc acting
as a "work that uses the Library":

The versions of these libraries were not modified from their upstream versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the attached
runc source code) may be used to exercise your rights under the LGPL-2.1.

However we strongly suggest that you make use of your distribution's packages
or download them from the authoritative upstream sources, especially since
these libraries are related to the security of your containers.

Thanks to the following people who made this release possible:

Vote: +5 -0 %2
Signed-off-by: Aleksa Sarai [email protected]

Assets 9
Loading